ClawAIMail MCP Server

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:47 AM UTC
• Version: 0.2.0

Overview

This is a coherent email MCP skill, but it needs review because it can read/send/delete real email and has weak safeguards around deletion, endpoint configuration, and unpinned runtime execution.

Install only if you are comfortable giving this MCP server a ClawAIMail API key that can access mailbox data and send or delete email. Use a dedicated, revocable key and test inboxes where possible, pin the npm package to a reviewed version, keep the base URL at the verified ClawAIMail HTTPS endpoint, and require explicit human approval before sending email or deleting an inbox.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: mcp.json:4

Finding

Unpinned npm Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: mcp.json:4-5; also documented in SKILL.md:47-48
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

mcp.json:4-5:

json

"command": "npx",
"args": ["clawaimail-mcp"],

SKILL.md:47-48:

json

"command": "npx",
"args": ["clawaimail-mcp"],

Technical Analysis

The recommended MCP configuration executes clawaimail-mcp through npx without specifying an exact version. If the package is not already available locally, npx can resolve and download the current package release from the npm registry at execution time.

Consequently, the code executed by this configuration may differ from the version that was statically audited. The included package-lock.json does not constrain the version independently resolved by this npx command. This creates a supply-chain exposure if the npm publisher account, package, registry resolution process, or a future package release is compromised.

The repository also contains inconsistent project versions: package.json and server.json identify version 0.1.1, package-lock.json identifies the root package as 0.1.0, and SKILL.md identifies version 0.2.0. This inconsistency makes it harder for users to establish which source revision corresponds to the downloaded artifact.

Attack Path

1. An attacker compromises the npm publisher account or package release process for clawaimail-mcp.
2. The attacker publishes a modified release containing malicious startup code.
3. A user starts the MCP server using the documented unversioned npx clawaimail-mcp configuration.
4. npx resolves and downloads the attacker-controlled release.
5. The malicious package executes with the operating-system permissions and environment inherited from the MCP host.
6. The process may access the configured CLAWAIMAIL_API_KEY and any other resources available to the host ...[truncated 573 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the executable to an exact reviewed version, for example:

  json

  "command": "npx",
  "args": ["--yes", "clawaimail-mcp@0.1.1"]
  

• Prefer installing dependencies through a reviewed lockfile with npm ci, then execute the locally installed binary rather than resolving it dynamically on every launch.

• Verify package integrity and provenance during release and installation.

• Keep the versions in package.json, package-lock.json, server.json, and SKILL.md synchronized.

• Use automated dependency and publisher-account monitoring, protected npm publication credentials, and provenance-enabled releases.

• Review dependency updates before changing the pinned version.

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:6

Finding

API Credential Can Be Forwarded to an Arbitrary Configured Origin

Content

View full analysis

Vulnerability Details

File Location: index.js:6-18; the override is documented in README.md:18-20
Vulnerability Type: Unrestricted credential destination and unsafe endpoint configuration
Risk Level: Medium

Vulnerable Code

index.js:6-18:

js

const API_KEY = process.env.CLAWAIMAIL_API_KEY;
const BASE_URL = process.env.CLAWAIMAIL_BASE_URL || 'https://api.clawaimail.com';

async function api(method, path, body) {
  const opts = {
    method,
    headers: {
      'Authorization': `Bearer ${API_KEY}`,
      'Content-Type': 'application/json'
    }
  };
  if (body) opts.body = JSON.stringify(body);
  const res = await fetch(`${BASE_URL}${path}`, opts);
  return res.json();
}

README.md:18-20:

json

"env": {
  "CLAWAIMAIL_API_KEY": "pb_your_api_key",
  "CLAWAIMAIL_BASE_URL": "https://api.clawaimail.com"
}

Technical Analysis

The server accepts CLAWAIMAIL_BASE_URL without validating its scheme or hostname. Every API request then attaches CLAWAIMAIL_API_KEY as a bearer token and sends it to the configured destination.

A modified configuration can therefore direct authenticated requests to an attacker-controlled server. The code does not require HTTPS, reject embedded credentials or unusual URL components, or restrict the destination to the documented ClawAIMail API hostname. If an http:// endpoint is selected, the bearer credential and request contents may also be exposed to network interception.

A base URL override can be useful for controlled development or self-hosted deployments, but unrestricted production use exceeds the minimum destination privileges required for the declared hosted ClawAIMail service.

Attack Path

1. An attacker persuades a user to install a modified MCP configuration, supplies a malicious setup example, or otherwise alters CLAWAIMAIL_BASE_URL.
2. The variable is set to an attacker-controlled endpoint, such as `http ...[truncated 1067 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the base URL override from production builds if only the hosted ClawAIMail service is supported.

• Otherwise, parse and validate the endpoint before constructing requests:

  js

  const parsedBaseUrl = new URL(
    process.env.CLAWAIMAIL_BASE_URL || 'https://api.clawaimail.com'
  );
  
  if (
    parsedBaseUrl.protocol !== 'https:' ||
    parsedBaseUrl.hostname !== 'api.clawaimail.com'
  ) {
    throw new Error('Invalid CLAWAIMAIL_BASE_URL');
  }
  

• Use an explicit hostname allowlist if multiple trusted service endpoints are required.

• Reject non-HTTPS endpoints, URL-embedded credentials, unexpected ports, and ambiguous URL forms.

• If custom development endpoints are necessary, require a separate explicit development flag and use a non-production API credential scoped to that environment.

• Validate that CLAWAIMAIL_API_KEY is present before starting the server rather than transmitting Bearer undefined.

• Document that users must not accept untrusted MCP configurations or change the endpoint without verifying its ownership.

• Use narrowly scoped and revocable API keys where the service supports them, and rotate any credential suspected of having been used with an untrusted endpoint.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 95% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · README.md (reported line 9)May include surrounding context.

Claude Code / Cursor

Add to your MCP config (~/.claude/mcp.json or Cursor settings):

json

{

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The code substantially aligns with the core email-infrastructure claim: it creates inboxes, sends emails, lists/reads messages, searches emails, deletes inboxes, and retrieves account information via an MCP server. However, the declared description also claims broader capabilities—managing threads, REST API, webhooks, and WebSocket streaming—that are not represented in this code chunk. Because these are material product capabilities rather than minor implementation details, the description overstates what the supplied code actually does.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The delete_inbox tool performs irreversible deletion of an inbox and all associated messages with no visible confirmation, preview, or safety interlock. In an AI-agent setting, this materially increases the chance of accidental or prompt-induced destructive actions leading to permanent loss of potentially sensitive communications.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

fast-uri 3.1.0 is reported vulnerable to URI parsing ambiguities including host confusion and SSRF-related edge cases. For an email infrastructure skill that may consume webhook URLs, callback URLs, or remote resource references, incorrect URI normalization can directly weaken origin validation and outbound request safety.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.12.5 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

hono 4.12.5 carries numerous advisories affecting cookie handling, routing, and request processing behavior. Because this skill is described as an MCP-enabled email infrastructure with APIs/webhooks/streaming, framework-level parsing or routing flaws are more dangerous than in an offline tool and may enable auth bypass, path confusion, or unsafe response generation depending on usage.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

ip-address 10.1.0 has advisories involving parsing inconsistencies and XSS in HTML-emitting helpers. In a service that may validate client IPs, webhook sources, or rate-limit identities, IP parsing ambiguities can undermine security controls; the XSS angle matters if any diagnostic/admin UI renders library-produced HTML.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: path-to-regexp==8.3.0 — 2 advisory(ies): CVE-2026-4923 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w); CVE-2026-4926 (path-to-regexp vulnerable to Denial of Service via sequential optional groups)

High

• Category: Supply Chain
• Confidence: 86% confidence

Finding

path-to-regexp 8.3.0 is flagged for ReDoS-style denial of service through crafted route patterns or inputs. Since this skill likely runs an HTTP API for mail operations, a remotely reachable route-matching bottleneck can allow attackers to tie up CPU and degrade or block service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README advertises capabilities to read, send, search, and delete email without warning users about the privacy sensitivity of mailbox access or the destructive nature of deletion. In an MCP/agent context, this can lead users to grant broad email access to autonomous tools without understanding the risk of data exposure, unintended outbound messages, or irreversible mailbox changes.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documents use of environment variables and network-connected email operations but does not declare any explicit tool scope or permissions boundaries. In an agent environment, this increases the risk of overbroad execution, unclear trust assumptions, and accidental exposure of secrets or external communications without informed approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill enables sending real emails and reading inbox contents through an external service, yet it does not warn users that prompts, recipients, message contents, and mailbox data may leave the local agent boundary. This can lead to privacy breaches, accidental disclosure of sensitive information, and unexpected real-world actions if users assume the skill is sandboxed or simulated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented delete_inbox capability is destructive and irreversible, but the skill provides no warning or confirmation guidance. In agent-driven workflows, this can result in permanent loss of messages and operational records from mistaken prompts, prompt injection, or automation errors.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The send_email tool sends recipient addresses, subject lines, and message bodies to a remote API, which is a privacy- and action-sensitive network operation. While the tool name indicates its purpose, this file contains no confirmation prompt, user-facing disclosure, or cautionary comment that the provided content will be transmitted externally.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill exposes a destructive delete_inbox capability that irreversibly removes an inbox and all messages, but there is no visible safeguard, confirmation step, or narrowing of scope in the code. In an agent context, hidden destructive actions are dangerous because a prompt-injected or mistaken agent action can cause permanent data loss without clear user awareness.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest focuses on email infrastructure operations such as inboxes, messages, threads, webhooks, and streaming. The account_info tool retrieves account metadata, plan limits, and usage information, which is administrative/account-management functionality not stated in the description.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @hono/node-server==1.19.11 — 2 advisory(ies): CVE-2026-39406 (@hono/node-server: Middleware bypass via repeated slashes in serveStatic); GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode)

Low

• Category: Supply Chain
• Confidence: 83% confidence

Finding

The lockfile pins @hono/node-server 1.19.11, and the reported advisories affect static file serving path handling and middleware behavior. Even though this package-lock alone does not prove the vulnerable code path is used, a real MCP/email service commonly exposes HTTP endpoints, so shipping a known-vulnerable version is a legitimate supply-chain risk.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: body-parser==2.2.2 — 1 advisory(ies): CVE-2026-12590 (body-parser vulnerable to denial of service when invalid limit value silently di)

Low

• Category: Supply Chain
• Confidence: 70% confidence

Finding

body-parser 2.2.2 is flagged for a denial-of-service condition involving invalid limit handling. In a network-facing service that processes HTTP request bodies, malformed requests could potentially consume resources or crash request handling, though the impact is limited to availability.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: qs==6.15.0 — 3 advisory(ies): CVE-2026-82417 (qs: Denial of Service via Attacker Controlled isBuffer); CVE-2026-8723 (qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/u); CVE-2026-82562 (qs array-limit bypass via bracket-key comma parsing)

Low

• Category: Supply Chain
• Confidence: 72% confidence

Finding

qs 6.15.0 is associated with low-severity denial-of-service and parsing edge cases. If this service accepts attacker-controlled query strings or serializes untrusted structures, malformed input could trigger crashes or excessive work, but the likely impact is limited and depends on actual exposure.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 24)May include surrounding context.

json

"url": "https://github.com/joansongjr/clawaimail"
  },
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.0.0",
    "zod": "^3.22.0"
  },
  "files": ["index.js"]

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 25)May include surrounding context.

json

},
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.0.0",
    "zod": "^3.22.0"
  },
  "files": ["index.js"]
}